azdo-cli 0.20.0-feature-042-update-notice-command.739 → 0.20.0-feature-043-dpapi-credential-store.742

package/dist/{chunk-K2CKMY72.js → chunk-B76UX3CR.js}

@@ -34,6 +34,21 @@ var CODE_CHALLENGE_METHOD = "S256";
 import fs from "fs";
 import path from "path";
 import os from "os";
+
+// src/services/credential-store-kind.ts
+var CREDENTIAL_STORES = ["keyring", "dpapi"];
+function parseCredentialStore(value, platform = process.platform) {
+  const normalised = value.trim().toLowerCase();
+  if (!CREDENTIAL_STORES.includes(normalised)) {
+    throw new Error(`Invalid value "${value}" for credentialStore. Must be one of: ${CREDENTIAL_STORES.join(", ")}.`);
+  }
+  if (normalised === "dpapi" && platform !== "win32") {
+    throw new Error('credentialStore "dpapi" is only available on Windows.');
+  }
+  return normalised;
+}
+
+// src/services/config-store.ts
 var SETTINGS = [
   {
     key: "org",
@@ -62,6 +77,13 @@ var SETTINGS = [
     type: "boolean",
     example: "true",
     required: false
+  },
+  {
+    key: "credentialStore",
+    description: 'Where credentials are stored: "keyring" (OS vault, default) or "dpapi" (Windows only, ~/.azdo/credentials)',
+    type: "string",
+    example: "dpapi",
+    required: false
   }
 ];
 var VALID_KEYS = SETTINGS.map((s) => s.key);
@@ -128,6 +150,8 @@ function setConfigValue(key, value) {
       throw new Error(`Invalid value "${value}" for markdown. Must be "true" or "false".`);
     }
     config.markdown = value === "true";
+  } else if (key === "credentialStore") {
+    config.credentialStore = parseCredentialStore(value);
   } else if (key === "fields") {
     config.fields = value.split(",").map((s) => s.trim());
   } else {
@@ -209,7 +233,7 @@ function getOrgScopedValue(org, key) {
 }
 function readScope(config, name) {
   if (name === "default") {
-    const { org: _o, organizations: _orgs, ...defaults } = config;
+    const { org: _o, organizations: _orgs, credentialStore: _cs, ...defaults } = config;
     return defaults;
   }
   return config.organizations?.[name.toLowerCase()] ?? {};
@@ -476,11 +500,11 @@ function handleCallback(req, res, active) {
     return;
   }
   const url = new URL(req.url, "http://127.0.0.1");
-  const path3 = url.pathname;
+  const path4 = url.pathname;
   const q = url.searchParams;
-  if (path3 !== "/callback" && path3 !== "/") {
-    writeError(res, 404, `unexpected path ${path3}`);
-    if (active) active.reject(new OAuthFlowError("redirect-mismatch", `unexpected callback path "${path3}"`));
+  if (path4 !== "/callback" && path4 !== "/") {
+    writeError(res, 404, `unexpected path ${path4}`);
+    if (active) active.reject(new OAuthFlowError("redirect-mismatch", `unexpected callback path "${path4}"`));
     return;
   }
   if (!active) {
@@ -746,10 +770,16 @@ function readAuditEvents() {
 import { Entry } from "@napi-rs/keyring";
 
 // src/types/credential.ts
+function defaultUnavailableMessage(backend) {
+  const base = `OS secret backend unavailable (${backend}). Install the platform's credential service and try again.`;
+  if (backend !== "windows-credential-manager") return base;
+  return `${base}
+Over SSH, Windows Credential Manager is not reachable. Store credentials with DPAPI in ~/.azdo instead: \`azdo config set credentialStore dpapi\` (or AZDO_CREDENTIAL_STORE=dpapi), then \`azdo auth login\` again.`;
+}
 var CredentialStoreUnavailableError = class extends Error {
   backend;
-  constructor(backend, cause) {
-    super(`OS secret backend unavailable (${backend}). Install the platform's credential service and try again.`);
+  constructor(backend, cause, message) {
+    super(message ?? defaultUnavailableMessage(backend));
     this.name = "CredentialStoreUnavailableError";
     this.backend = backend;
     if (cause instanceof Error) {
@@ -796,13 +826,147 @@ function normalizePat(rawPat) {
   return trimmedPat.length > 0 ? trimmedPat : null;
 }
 
+// src/services/dpapi-store.ts
+import fs3 from "fs";
+import os3 from "os";
+import path3 from "path";
+
+// src/services/dpapi-binding.ts
+import { createRequire } from "module";
+var cached = null;
+function loadDpapi() {
+  if (cached) return cached;
+  const require2 = createRequire(import.meta.url);
+  const mod = require2("@primno/dpapi");
+  if (!mod.isPlatformSupported) {
+    throw new Error("the @primno/dpapi native binary is not available for this platform");
+  }
+  cached = mod.Dpapi;
+  return cached;
+}
+
+// src/services/dpapi-store.ts
+var BACKEND = "windows-dpapi";
+var FILENAME_UNSAFE = /[^A-Za-z0-9_.-]/g;
+function dpapiCredentialsDir() {
+  return path3.join(os3.homedir(), ".azdo", "credentials");
+}
+function dpapiFilePath(account) {
+  const safe = account.replaceAll(FILENAME_UNSAFE, (ch) => `_${ch.codePointAt(0).toString(16)}`);
+  return path3.join(dpapiCredentialsDir(), `${safe}.dpapi`);
+}
+function entropyFor(account) {
+  return Buffer.from(`azdo-cli:${account}`, "utf8");
+}
+function unavailable(cause, message) {
+  return new CredentialStoreUnavailableError(BACKEND, cause, message);
+}
+function binding() {
+  try {
+    return loadDpapi();
+  } catch (err) {
+    throw unavailable(
+      err,
+      `DPAPI credential store unavailable: ${err.message}. Reinstall azdo-cli, or switch back with \`azdo config set credentialStore keyring\`.`
+    );
+  }
+}
+function isNotFound(err) {
+  return err.code === "ENOENT";
+}
+var DpapiEntry = class {
+  constructor(account) {
+    this.account = account;
+    this.file = dpapiFilePath(account);
+  }
+  account;
+  file;
+  getPassword() {
+    let blob;
+    try {
+      blob = fs3.readFileSync(this.file);
+    } catch (err) {
+      if (isNotFound(err)) return null;
+      throw unavailable(err, `Could not read the DPAPI credential file ${this.file}: ${err.message}`);
+    }
+    try {
+      const plain = binding().unprotectData(blob, entropyFor(this.account), "CurrentUser");
+      return Buffer.from(plain).toString("utf8");
+    } catch (err) {
+      if (err instanceof CredentialStoreUnavailableError) throw err;
+      throw unavailable(
+        err,
+        `Could not decrypt the DPAPI credential file ${this.file}: ${err.message}. It was written by another Windows user, on another machine, or from a logon session without access to your DPAPI master key. Run \`azdo auth login\` again from this session to replace it.`
+      );
+    }
+  }
+  setPassword(value) {
+    const dpapi = binding();
+    const entropy = entropyFor(this.account);
+    let blob;
+    try {
+      blob = dpapi.protectData(Buffer.from(value, "utf8"), entropy, "CurrentUser");
+      const check = Buffer.from(dpapi.unprotectData(blob, entropy, "CurrentUser")).toString("utf8");
+      if (check !== value) throw new Error("decrypted value does not match");
+    } catch (err) {
+      throw unavailable(
+        err,
+        `DPAPI could not protect the credential in this session: ${err.message}. Nothing was stored. Over SSH this usually means the logon has no access to your DPAPI master key (common with public-key authentication); log in with a password, or use AZDO_PAT for this session.`
+      );
+    }
+    const tmp = `${this.file}.${process.pid}.tmp`;
+    try {
+      fs3.mkdirSync(dpapiCredentialsDir(), { recursive: true, mode: 448 });
+      fs3.writeFileSync(tmp, blob, { mode: 384 });
+      fs3.renameSync(tmp, this.file);
+    } catch (err) {
+      fs3.rmSync(tmp, { force: true });
+      throw unavailable(err, `Could not write the DPAPI credential file ${this.file}: ${err.message}`);
+    }
+  }
+  deletePassword() {
+    try {
+      fs3.unlinkSync(this.file);
+      return true;
+    } catch (err) {
+      if (isNotFound(err)) return false;
+      throw unavailable(err, `Could not delete the DPAPI credential file ${this.file}: ${err.message}`);
+    }
+  }
+};
+
 // src/services/credential-store.ts
 var SERVICE = "azdo-cli";
 var LEGACY_ACCOUNT = "pat";
 function accountFor(org) {
   return `pat:${org}`;
 }
+function requestedStore() {
+  const fromEnv = process.env.AZDO_CREDENTIAL_STORE?.trim();
+  if (fromEnv) return fromEnv.toLowerCase();
+  let fromConfig;
+  try {
+    fromConfig = loadConfig()?.credentialStore;
+  } catch {
+    fromConfig = void 0;
+  }
+  return fromConfig?.trim().toLowerCase() || "keyring";
+}
+function activeCredentialStore() {
+  const requested = requestedStore();
+  try {
+    return parseCredentialStore(requested);
+  } catch (err) {
+    const backend = requested === "dpapi" ? "windows-dpapi" : "unknown";
+    throw new CredentialStoreUnavailableError(
+      backend,
+      err,
+      `${err.message} Set it with \`azdo config set credentialStore <keyring|dpapi>\` or AZDO_CREDENTIAL_STORE.`
+    );
+  }
+}
 function probeBackend() {
+  if (requestedStore() === "dpapi") return "windows-dpapi";
   switch (process.platform) {
     case "win32":
       return "windows-credential-manager";
@@ -818,10 +982,12 @@ function wrapUnavailable(fn) {
   try {
     return fn();
   } catch (err) {
+    if (err instanceof CredentialStoreUnavailableError) throw err;
     throw new CredentialStoreUnavailableError(probeBackend(), err);
   }
 }
 function entryFor(account) {
+  if (activeCredentialStore() === "dpapi") return new DpapiEntry(account);
   return wrapUnavailable(() => new Entry(SERVICE, account));
 }
 var legacyUnsetNoticeEmitted = false;
@@ -897,6 +1063,7 @@ function serializeCredential(cred) {
   return JSON.stringify(cred);
 }
 async function maybeMigrateLegacy(targetOrg) {
+  if (activeCredentialStore() === "dpapi") return null;
   const config = loadConfig();
   if (!config.org || config.org !== targetOrg) {
     if (!config.org) {
@@ -998,7 +1165,7 @@ async function deletePat(org) {
   }
   try {
     const { unlinkSync: unlinkSync2 } = await import("fs");
-    const { lockPath: lockPath2 } = await import("./oauth-token-refresh-PXUQE5JE.js");
+    const { lockPath: lockPath2 } = await import("./oauth-token-refresh-5O2DYWFR.js");
     unlinkSync2(lockPath2(org));
   } catch {
   }
@@ -1031,23 +1198,23 @@ var inFlight = /* @__PURE__ */ new Map();
 function locksDir() {
   return join(homedir(), ".azdo", ".locks");
 }
-var FILENAME_UNSAFE = /[^A-Za-z0-9_.-]/g;
+var FILENAME_UNSAFE2 = /[^A-Za-z0-9_.-]/g;
 function lockPath(org) {
-  const safe = org.replaceAll(FILENAME_UNSAFE, "_");
+  const safe = org.replaceAll(FILENAME_UNSAFE2, "_");
   return join(locksDir(), `${safe}.refresh`);
 }
 async function defaultAcquireLock(org, waitMs = DEFAULT_LOCK_WAIT_MS) {
-  const path3 = lockPath(org);
+  const path4 = lockPath(org);
   mkdirSync(locksDir(), { recursive: true, mode: 448 });
   const deadline = Date.now() + waitMs;
   for (; ; ) {
     try {
-      const fd = openSync(path3, "wx");
+      const fd = openSync(path4, "wx");
       closeSync(fd);
       return {
         release: () => {
           try {
-            unlinkSync(path3);
+            unlinkSync(path4);
           } catch {
           }
         }

package/dist/index.js

@@ -37,7 +37,7 @@ import {
   tokenResponseToCredential,
   unsetConfigValue,
   unsetOrgScopedValue
-} from "./chunk-K2CKMY72.js";
+} from "./chunk-B76UX3CR.js";
 
 // src/program.ts
 import { Command as Command19 } from "commander";
@@ -2702,7 +2702,8 @@ function createConfigCommand() {
       "",
       "Credentials are NOT stored in the configuration file. They are resolved in this order:",
       "  1. the AZDO_PAT environment variable (wins over everything below)",
-      "  2. the OS credential store, per organization (see `azdo auth login`)",
+      "  2. the OS credential store, per organization (see `azdo auth login`) \u2014 or, with",
+      "     `credentialStore` set to dpapi (Windows), DPAPI-encrypted files in ~/.azdo/credentials",
       "  3. a .env file with AZDO_PAT, searched upwards from the working directory",
       "",
       "Only AZDO_PAT is read \u2014 AZURE_DEVOPS_PAT, AZURE_DEVOPS_EXT_PAT and AZDO_TOKEN are ignored.",
@@ -2712,7 +2713,7 @@ function createConfigCommand() {
     ].join("\n")
   );
   const set = new Command4("set");
-  set.description("Set a configuration value").argument("<key>", "setting key (org, project, fields, markdown)").argument("<value>", "setting value").option("--org <org>", "set value in an org-scoped configuration").option("--json", "output in JSON format").action((key, value, options) => {
+  set.description("Set a configuration value").argument("<key>", "setting key (org, project, fields, markdown, credentialStore)").argument("<value>", "setting value").option("--org <org>", "set value in an org-scoped configuration").option("--json", "output in JSON format").action((key, value, options) => {
     try {
       if (options.org) {
         setOrgScopedValue(options.org, key, value);
@@ -2738,7 +2739,7 @@ function createConfigCommand() {
     }
   });
   const get = new Command4("get");
-  get.description("Get a configuration value").argument("<key>", "setting key (org, project, fields, markdown)").option("--org <org>", "read from an org-scoped configuration").option("--json", "output in JSON format").action((key, options) => {
+  get.description("Get a configuration value").argument("<key>", "setting key (org, project, fields, markdown, credentialStore)").option("--org <org>", "read from an org-scoped configuration").option("--json", "output in JSON format").action((key, options) => {
     try {
       const value = options.org ? getOrgScopedValue(options.org, key) : getConfigValue(key);
       if (options.json) {
@@ -2771,7 +2772,7 @@ function createConfigCommand() {
     writeConfigList(cfg);
   });
   const unset = new Command4("unset");
-  unset.description("Remove a configuration value").argument("<key>", "setting key (org, project, fields, markdown)").option("--org <org>", "remove from an org-scoped configuration").option("--json", "output in JSON format").action((key, options) => {
+  unset.description("Remove a configuration value").argument("<key>", "setting key (org, project, fields, markdown, credentialStore)").option("--org <org>", "remove from an org-scoped configuration").option("--json", "output in JSON format").action((key, options) => {
     try {
       if (options.org) {
         unsetOrgScopedValue(options.org, key);
@@ -2809,6 +2810,7 @@ function createConfigCommand() {
     process.stderr.write("Azure DevOps CLI - Configuration Wizard\n");
     process.stderr.write("=======================================\n\n");
     for (const setting of SETTINGS) {
+      if (setting.key === "credentialStore") continue;
       await promptForSetting(cfg, setting, ask);
     }
     rl.close();

package/dist/{oauth-token-refresh-PXUQE5JE.js → oauth-token-refresh-5O2DYWFR.js}

@@ -5,7 +5,7 @@ import {
   lockPath,
   locksDir,
   refreshIfNeeded
-} from "./chunk-K2CKMY72.js";
+} from "./chunk-B76UX3CR.js";
 export {
   _resetInFlight,
   classifyRefreshFailure,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "azdo-cli",
-  "version": "0.20.0-feature-042-update-notice-command.739",
+  "version": "0.20.0-feature-043-dpapi-credential-store.742",
   "description": "Azure DevOps CLI tool",
   "type": "module",
   "bin": {
@@ -26,6 +26,7 @@
   "license": "MIT",
   "dependencies": {
     "@napi-rs/keyring": "^1.2.0",
+    "@primno/dpapi": "^2.0.1",
     "commander": "^14.0.3",
     "jimp": "^1.6.1",
     "node-html-markdown": "^2.0.0"